4

I am trying to enable HTTPS connections to a website hosted through IIS on an Amazon EC2 instance. The instance is running Windows Server 2012. I do not have a wildcard certificate.

The EC2 instance is running under the VPC - it has a VPC ID.

When viewing the instance through the AWS console I see a public IP displayed, but I do not see a public DNS record. However, if I tracert to the public IP, I see the following DNS: 

ec2-xx-xxx-xx-xxx.compute-1.amazonaws.com

I am not confident that this DNS record is static.

When generating a CRS through IIS I need to provide a 'Common Name' for the cert. I believe that this should be the DNS record mentioned above.

My questions:

  • Should I be using the aforementioned amazonaws subdomain as the Common Name for my SSL certificate?
  • If yes, is it safe to assume that the aforementioned DNS name, which is derived from my public IP, will not change on me? If the public IP address changes then I assume the DNS changes as well, which would invalidate my SSL certificate.
  • If either answer is no, what are the correct steps to create a valid Common Name for an EC2 instance?
Improve this question

1 Answer 1

Reset to default
4

You should create your CSR using your own domain name for the Common Name. If you're planning to run your website on https://www.example.com, use www.example.com for the Common Name. (ie, include the www).

Otherwise, folks will have to access your website by visiting:

https://ec2-xx-xxx-xx-xxx.compute-1.amazonaws.com

Which is probably not what you want.

(Besides, the CA issuing your cert is going to need to verify that you own the domain, and unless you are secretly Jeff Bezos, theyre not going to [or at least shouldn't] issue you a cert for anything in amazonaws.com.)

Of course, you will need to point your domain to the EC2 instance. Typically Amazon recommends should that you create a CNAME for www under your domain, pointing to the domain name provided by amazon. so for instance:

www.example.com. IN CNAME ec2-xx-xxx-xx-xxx.compute-1.amazonaws.com.

Alternatively, you could use Amazon's Route53 for the DNS for your own domain, and point your domain to your EC2 instance automatically.

Improve this answer
1
  • 1
    Thank you. This helped clarify a lot for me. My domain name provider isn't through Amazon, but, after assigning an Elastic IP to my EC2 instance, I was able to setup a redirect through my domain provider's cPanel from a sub-domain of my choosing (aws-server.xxx.com) to the Elastic IP. That seems like it'll suit me just fine!
    – Sean Anderson
    Aug 15, 2014 at 3:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .